US agencies accuse Chinese AI firms of distilling US models

On September 8, 2026, the NSA, CISA, and FBI released a joint cybersecurity advisory, AA26-251A, accusing six China-based AI companies of conducting industrial-scale knowledge distillation against US frontier models since at least late 2024 ^[1]. Knowledge distillation itself is not exotic: a smaller 'student' model is trained to mimic the outputs of a larger 'teacher' model, learning to approximate its reasoning patterns without needing the teacher's original training data or compute budget. What the advisory alleges is different in scale and method. It says the accused firms treated distillation as 'the core - not merely a supplement - of their AI development strategy,' and routed requests through native APIs, remote cloud providers, and third-party aggregators specifically chosen to obscure user metadata and evade the target companies' terms of use ^[2]. The advisory also identifies a gray market of proxy services called 'transfer stations,' reportedly marketed on Chinese platforms Taobao and Xianyu, that bypass geographic restrictions and safeguards, alongside bulk purchases of premium subscriptions shared across developer teams to keep the cost of extraction low ^[3].

The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and says the campaigns extracted billions of tokens across millions of exchanges from variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini, and xAI's Grok ^[1]. DeepSeek and Moonshot AI are named as the top offenders: DeepSeek is accused of distilling multiple versions of Claude, Gemini, ChatGPT, and Grok to train its R1 model, while Moonshot AI allegedly distilled 18 different US models to build Kimi-K2 and Kimi-K3 ^[3]. Alibaba is accused of using industrial-scale distillation to improve its Qwen family, and Z.AI allegedly pulled billions of tokens of chain-of-thought reasoning from GPT-5.5 and Claude Opus 4.8 by mid-2026 ^[4]. Separately, and ahead of the government advisory, Anthropic said it had identified roughly 24,000 fake accounts and more than 16 million interactions with Claude used by DeepSeek, Moonshot, and MiniMax to extract its capabilities ^[5]. The advisory also takes a swipe at DeepSeek's credibility, questioning its widely publicized $5.6 million training-cost figure on the grounds that it excludes the value of the distilled training data pulled from US frontier models ^[4].

The advisory's language - 'systematic extraction,' 'industrial-scale' - casts distillation as adversarial IP theft, and CISA's leadership has echoed that framing publicly. But the claim is far from uncontested. Chinese state media has pushed back directly: a Global Times-cited commentator dismissed Anthropic's distillation claims as lacking substance and argued they are 'rooted in tech hegemony anxiety,' framing the accusations as an attempt to protect a fading US monopoly rather than address genuine wrongdoing ^[6]. Independent academics occupy more cautious middle ground - Erik Cambria, an AI professor at Nanyang Technological University, has noted that 'the boundary between legitimate use and adversarial exploitation is often blurry' ^[7], since distillation via paid API access is a widely used, technically unremarkable machine-learning technique rather than a hack. That ambiguity matters because the advisory's own evidence describes paying customers using publicly available APIs and cloud services, not intrusion or credential theft - the alleged violation is of terms of use and access-control evasion, not a breach in the traditional cybersecurity sense.

The government advisory did not emerge in isolation. OpenAI first told Axios in January 2025 that it had evidence of distillation attempts by China-based groups targeting its models, shortly after DeepSeek's R1 release drew scrutiny ^[8]. By February 2026, OpenAI told Congress that DeepSeek had used distillation and obfuscated routers to 'free-ride' on US frontier-lab capabilities, the same month Anthropic separately reported industrial-scale distillation campaigns by DeepSeek, Moonshot AI, and MiniMax against Claude ^[9]. That reporting prompted a policy debate in Washington by July 2026 over penalties, export controls, and legal safeguards for AI labs ^[10]. By early September, Anthropic said its fight against distillation had extended into dark-web-adjacent gray markets just before the joint advisory landed ^[11]. Officials frame the stakes in stark competitive terms: unchecked distillation, they warn, threatens to close the capability gap that has defined US AI leadership ^[12]. CISA's Acting Director has publicly urged AI companies to 'take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies' ^[4]. That urgency is bolstered by an independent data point circulating in tech commentary: aggregate model-usage data reportedly showed Chinese open-source model traffic climbing from roughly a fifth to about half of total usage over the past year, while US model usage over the same period slid from about three-quarters to roughly a third - two separate trend lines, not a clean one-for-one swap, that together critics say reflect price competition as much as any distillation-driven capability catch-up, alongside a persistent counter-argument that American labs built their own frontier models by scraping the open web without payment or consent in the first place.